Can’t believe you’re the only one that had reviewed the code until now. Do you refer to Sparrow just the desktop client or any specific functionality within it?
I am not the only one, whirpool's shortcomings have been addressed before by others, both xpub exposure, lack of identity management, and key tagging vulnerabilities in signature management by the coordinator. When I refer to sparrow it is using the whirpool function.